(PUP-391) Use FFI.errno instead of GetLastError

 - In commit bf6f5c4e67c527d97da2dd3ee692692c8b9a8981, @@GetLastError
   was introduced as a band-aid to ensure the appropriate error code
   was read out of the thread local storage after a Win32 API call was
   made.  At that time, not all of the code had been converted to FFI
   compatible and not all gems had been upgraded to FFI compatible.
   Calls still made using Win32API were not captured by FFI.errno (which
   only calls GetLastError *after* making an FFI defined Win32 API call)
   resulting in a number of test fails.  The solution at the time was
   to manually call GetLastError instead to retrieve the value set by
   SetLastError.
 - Now that all Win32 API calls are made through FFI, FFI will
   automatically capture API results by calling GetLastError, and we
   can remove the unnecessary binding to GetLastError here.
Merge remote-tracking branch 'upstream/master' into puppet-4

* upstream/master:
  (PUP-1177) Use Puppet::FileSystem.chmod
  (PUP-392) Upgrade win32-dir to 0.4.9
  (PUP-1283) Relax win32-service constraint
  Revert "(maint) Correct ssl/puppet_cert_generate_and_autosign test to do what it..."
  (doc) Fix "mangement" typo
  (PUP-392) Upgrade win32-process
  (PUP-392) update win32-eventlog
  (PUP-1283) Upgrade win32-service gem
  (PUP-2866) Read UID_MIN from login.defs instead of hardcoding value.
  (PUP-1281) Don't use win32console if ruby v2
  (PUP-2869) Puppet should support HTTP proxy authentication
  (PUP-1811) Fix collection use of include?
  (PUP-2079) Add no-op PMT generate template format.
  (PUP-1177) restore :ram FileType compatibility
  (PUP-1177) update ParsedFile provider unit tests
  (PUP-1177) make sure ssh_known_hosts is not created with mode 0600
  (maint) move the file mode tests to the files spec module
  (PUP-1177) allow parsedfile providers to choose a default mode
  (maint) Correct ssl/puppet_cert_generate_and_autosign test to do what it says it's doing.
(PUP-1281) Ensure don't override stdout/stderr (windows/ruby2)

This provides a more deterministic set of specs that determine whether we have
wrapped $stderr/$stdout or not based on ruby version.
(PUP-391) Fix Rdoc 4+ specs on Windows Ruby 2 x64

 - When calling the document method on RDoc and the root option has not
   been specified, RDoc will provide a default in the options class:
   @root = Pathname(Dir.pwd).  NOTE: This does not affect RDoc 3.9.5
   that ships with Ruby 1.9.3 on Windows, only RDoc 4.0.0+ that ships
   with Ruby 2.0.0+ on Windows.
 - The win32-dir monkey patches the Dir.pwd method, and instead of
   using / separators like the rest of Ruby, it uses \ as a path
   separator.
 - RDoc uses Pathname, specifically the relative_path_from method
   which expects / separators, and gets confused with \.  Therefore,
   provide a workaround to ensure that Windows uses the appropriate
   / in paths.
(PUP-391) Ruby 2 exception type changed to EISDIR

 - File.open now raises EISDIR when a path is a directory, prior to
   verifying permissions in Ruby 2.  Files continue to return EACCESS.
Revert "(PUP-392) update win32-eventlog"

This reverts commit cffa48679b20362b3a50403a7460c1400524d790.

We need to revert win32-eventlog updates for now since it now has
dependencies on a library that doesn't exist in Windows 2003.
Merge branch 'pr/2839'

* pr/2839:
  Revert "(PUP-392) update win32-eventlog"
Merge remote-tracking branch 'upstream/master' into puppet-4

* upstream/master:
  Revert "(PUP-392) update win32-eventlog"
Merge pull request #2836 from zaphod42/issue/master/pup-500-define-collection-semantics

(PUP-500) Increase coverage of collection queries
Merge remote-tracking branch 'rob/ticket/master/PUP-1281-colors-specs'

* rob/ticket/master/PUP-1281-colors-specs:
  (PUP-1281) Ensure don't override stdout/stderr (windows/ruby2)
Merge branch 'pr/2829'

* pr/2829:
  (PUP-391) Ruby 2 exception type changed to EISDIR
  (PUP-391) Fix Rdoc 4+ specs on Windows Ruby 2 x64
  (PUP-391) Use FFI.errno instead of GetLastError
  (PUP-391) Remove unused file19windows.rb variable
  (PUP-391) Fix INVALID_FILE_ATTRIBUTES on x64
(PUP-2858) Remove duplicated testing (evaluator = 'current')

There was a test (environment_spec) that ran an extra time
with the hybrid parser = future, evaluator = current which results
in the same tests running twice. (This because the future evaluator
is enforced when runing with future parser).
(maint) Remove duplicated logging of error.

This removes a duplicated logging of error when attempting to
override an already set resource parameter. This used to result in
the error showing up three times on the console instead of the expected
two.
Merge branch 'master' of ssh://github.com/puppetlabs/puppet.git
(PUP-2177) Change Crypto Spec in accordance to bettercrypto.org

We provide an Apache vhost configuration for users that want to run a
Puppet master using Apache and Passenger. The configuration was added in
d85d73c (five years ago, roughly) and set the SSLProtocol and
SSLCipherSuite directives using the assumptions about cryptography at
the time. As part of PUP-2582 commit 05af20b70 updated the SSL cipher
suite and protocol settings to remove some of the most vulnerable
ciphers, but still contained some relaxed settings to ensure
compatibility with as many platforms as possible.

-- Summary

This commit updates the SSLProtocol and SSLCipherSuite directives to
ensure we only use secure ciphers while continuing to function on all
supported platforms. The most notable difference is that this change
switches the cipher selection from a blacklist where all ciphers are
added and then selectively removed, to a whitelist where only known safe
ciphers are allowed. The cipher suite has been selected using the
guidelines laid out by the Applied Crypto Hardening paper[0].

-- Overall cipher selection

This cipher suite was chosen by selecting for the following criteria:

  * TLS 1.0, 1.1, 1.2
  * Perfect forward secrecy/ephemeral Diffie Hellman where possible
  * Preferring strong MACs (SHA-2) where possible
  * GCM as the authenticated encryption scheme where possible
  * Always falling back to reasonably acceptable schemes for maximum
    platform compatibility

The resulting cipher suite has the following implications:

TLSv1.2 is preferred over TLSv1.0, but is still provides reasonable
ciphers with TLSv1.0.

-- Key exchange

Ephemeral Diffie Hellman and Ephemeral Elliptic Curve Diffie Hellman are
used for key exchange. EDH is preferred over EECDH due to ongoing
concerns with potential weaknesses in elliptic curve cryptography, but
EECDH is still included due to the performance benefits of EECDH over
EDH.[1] Non-ephemeral Diffie Hellman is not used to ensure perfect
forward secrecy. If EDH or EECDH are not available, key exchange will be
done using RSA for compatibility with legacy SSL libraries.

-- Authentication

RSA is used for authentication as it works in most of today's setups and
modern implementations are resistant to attack for the foreseeable future.

-- Encryption

AES256 and CAMELLIA256 count as very strong ciphers at the moment, but
if these algorithms are not available then AES128 or CAMELLIA128 will be
used as fallbacks since they are still reasonably strong. CAMELLIA is
preferred over AES due to the decision by NSS to prefer CAMELLIA, with
the following rationale:

    National ciphers such as Camellia are listed before international ciphers
    such as AES and RC4 to allow servers that prefer Camellia to be able to
    negotiate Camellia without having to disable AES and RC4, which are needed
    for interoperability with clients that don't yet implement Camellia.[2]

-- Message Authentication (MAC)

Message authentication prefers AEAD with GCM, and then falls back to
SHA256. If ECDHE is used SHA384 will be used when available. If no
better option is available SHA1 will be used.

-- Fallback

When no better cipher is available, CAMELLIA128-SHA and then AES128-SHA
(with RSA for authentication) will be used, for cases such as OpenSSL
0.9.8 which does not provide support for ECC and TLSv1.1 or above.

-- Blacklisted algorithms

On top of the algorithms blacklisted in 05af20b7, ECDSA has been
disabled due to outstanding concerns about weaknesses to cache timing
attacks.[3]

[0] "Applied Crypto Hardening": https://bettercrypto.org/static/applied-crypto-hardening.pdf
[1] "A Note on Elliptic Curve Cryptography" "Applied Crypto Hardening section 3.7"
[2] "Document the policy for the order of cipher suites in SSL_ImplementedCiphers.": https://bugzilla.mozilla.org/show_bug.cgi?id=430875
[3] "How to design an elliptic-curve signature system" http://blog.cr.yp.to/20140323-ecdsa.html

Thanks to Aaron Zauner <azet@azet.org> and bettercrypto.org for
generating and submitting the updated cipher suite.

Commit message amended by Adrien Thebo <adrien@puppetlabs.com>
(PUP-1281) Simplify test for wide console behavior

Previously, we were verifying that stdout and stderr were wrapped in WideIO
objects in ruby 1.9. However, this doesn't work in CI, because jenkins
redirects stdout and stderr.

This commit simplifies the test to not be as environmentally sensitive. It
just verifies that the WideConsole and WideIO classes have been defined in
ruby 1.x, and not defined in 2.x.
(PUP-500) Add additional tests cases

Test cases added that test that the current implementation does
not regress from its current behavior.

Regular resources are collected. Collection with override can be
done multiple times. Changing and amedning values work for 
regular resources as well as virtual.
(PUP-2711) Make manifest-directory load recursively

This changes the loaded of a manifest reference that is a directory
to include all .pp recursively in this directory. The content is
sorted so that all content of directory b comes before file c in its
parent directory (rule applied recursively).
(PUP-2711) Make recursive manifest parsing conditional to future parser

This makes the ability to load all .pp files under a manifest dir
recursively conditional to parser == future. (It will become the
standard in Puppet 4.0). This is done to avoid slurping in lots of files
in case users kept other files around in a subdirectory in the belief
that they would not be loaded. Thus making it harder to upgrade.

This also adds a test that runs for future parser.
(PUP-2711) Remove '*' without effect.